Category: Troubleshooting Microsoft Endpoint

The Defender for Identity logs provide insight into what each component of Microsoft Defender for Identity sensor is doing at any given point in time. The Defender for Identity logs are located in a subfolder called Logs where Defender for Identity is installed; the default location is: C:\Program Files\Azure Advanced Threat Protection Sensor\. In the default installation location, […]

This page provides detailed steps to troubleshoot live response issues. File cannot be accessed during live response sessions If while trying to take an action during a live response session, you encounter an error message stating that the file can’t be accessed, you’ll need to use the steps below to address the issue. Copy the […]

Devices that are categorized as misconfigured or inactive can be flagged due to varying causes. This section provides some explanations as to what might have caused a device to be categorized as inactive or misconfigured. Inactive devices An inactive device is not necessarily flagged due to an issue. The following actions taken on a device […]

You can find help here if you encounter issues while migrating from a third-party security solution to Microsoft Defender Antivirus. Review event logs Open the Event viewer app by selecting the Search icon in the taskbar, and searching for event viewer. Information about Microsoft Defender Antivirus can be found under Applications and Services Logs > Microsoft > Windows > Windows Defender. From there, select Open underneath Operational. Selecting […]

If you encounter a problem with Microsoft Defender Antivirus, you can search the tables in this topic to find a matching issue and potential solution. The tables list: Microsoft Defender Antivirus event IDs (these apply to Windows 10, Windows 11, and Windows Server 2016) Microsoft Defender Antivirus client error codes Internal Microsoft Defender Antivirus client error […]

If your system is having high CPU usage or performance issues related to the real-time protection service in Microsoft Defender for Endpoint, you can submit a ticket to Microsoft support. Follow the steps in Collect Microsoft Defender Antivirus diagnostic data. As an admin, you can also troubleshoot these issues on your own. First, you might want […]

 Important On March 31, 2020, the Microsoft Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using Microsoft Endpoint Manager, which allows finer control over security features and updates. You can use Microsoft Defender Antivirus with Update Compliance. You’ll see status for E3, B, F1, […]

You might need to troubleshoot the Microsoft Defender for Endpoint onboarding process if you encounter issues. This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the devices. Troubleshoot issues with onboarding tools If you have completed the […]